Low quality video on Webex direct call

[AndreaB]

Hello,

it is a few months that we have an issue on Webex call beetween two users (not on Webex meetings). Basically after a while the video call quality starts to decrease during a direct call on Webex beetween two users. 

We already disabled SIP ALG without experiencing any quality improvement on video calls.

By configuring monitoring on QoS we also found out that the used bandwith during those calls are a lot lower than the available bandwith. 

We also took a traffic capture, but for my current knowledge on Video/VOIP protocols i can't find a visible issue on this session.

I m wondering if maybe applying an application override policy on SIP could help.

Do you have any suggestion?

I attached the traffic capture and logs

Thanks and Regards

[Brandon_Wertz]

---

@AndreaB wrote:

Hello,

it is a few months that we have an issue on Webex call beetween two users (not on Webex meetings). Basically after a while the video call quality starts to decrease during a direct call on Webex beetween two users. 

We already disabled SIP ALG without experiencing any quality improvement on video calls.

By configuring monitoring on QoS we also found out that the used bandwith during those calls are a lot lower than the available bandwith. 

We also took a traffic capture, but for my current knowledge on Video/VOIP protocols i can't find a visible issue on this session.

I m wondering if maybe applying an application override policy on SIP could help.

Do you have any suggestion?

I attached the traffic capture and logs

Thanks and Regards

---

@AndreaB my suggestion for your problem would be similar to the recent WebEx issue post.

I would first create an IP based rule that allowed "any application" over service "any" to the known Cisco WebEx IP networks.  Then after 2-4 weeks review the applications that matched the rule and create an application based rule above your IP (L3) based rule.  Following the suggested method above will be a much easier way of troubleshooting.  Only do this of course following your internal approval processes for allowing traffic through your firewall.

You mentioned video quality degrading, if the issue is the actual video and not voice I don't think doing anything to the SIP application (Disabling ALG) will have anything to do with video quality.

You can use these 2 links to help identify the the ports/protocols/IPs are for the services you're using, but ultimately just opening it up by IP then narrowing it down to Palo Alto App-ID will be far easier than trying to look into what port/protocol isn't being allowed.

https://help.webex.com/en-us/article/WBX000028782/Network-Requirements-for-Webex-Services#id_134132

https://help.webex.com/en-us/article/b2exve/Port-Reference-Information-for-Webex-Calling

[AndreaB]

Hello @Brandon_Wertz ,

Thanks for your answer.

I would like to clarify a couple of things that i forgot to mention before. I think they could be helpful.

• On the traffic log you can see all the traffic was matched and allowed by the FW rules already in place on the FW, and no block or drop action is performed by a customized rule or the interzone-default .
• It seems that the issue appeared only after the replacement of the old PA-220 with the new PA-440 FWs. I checked the conf backups we took on the PA-220 and by confronting with the conf on the new FWs there is no evidence of some missing configuration that could explain the current FW behavior.

Therefore i ask if somebody already had a similar issue and if you know some particular bug/strange behavior on PA-440 that could explain this.

Thanks and Regards